[query] Validate namespace ID (#92)

#### Type of change

- Bug fix
 
#### Description

- Validate namespace ID to prevent SQL injections

#### Related issues

- resolves #84

Signed-off-by: Liran Funaro <liran.funaro@gmail.com>

Author: liran-funaro

service/query/query_service.go

@@ -20,8 +20,10 @@ import (
 	"github.com/hyperledger/fabric-x-committer/api/protoblocktx"
 	"github.com/hyperledger/fabric-x-committer/api/protoqueryservice"
 	"github.com/hyperledger/fabric-x-committer/service/vc"
+	"github.com/hyperledger/fabric-x-committer/service/verifier/policy"
 	"github.com/hyperledger/fabric-x-committer/utils/channel"
 	"github.com/hyperledger/fabric-x-committer/utils/connection"
+	"github.com/hyperledger/fabric-x-committer/utils/grpcerror"
 	"github.com/hyperledger/fabric-x-committer/utils/monitoring/promutil"
 )
 
@@ -133,6 +135,14 @@ func (q *Service) GetRows(
 	ctx context.Context, query *protoqueryservice.Query,
 ) (*protoqueryservice.Rows, error) {
 	q.metrics.requests.WithLabelValues(grpcGetRows).Inc()
+
+	for _, ns := range query.Namespaces {
+		err := policy.ValidateNamespaceID(ns.NsId)
+		if err != nil {
+			return nil, grpcerror.WrapInvalidArgument(err)
+		}
+	}
+
 	defer q.requestLatency(grpcGetRows, time.Now())
 	for _, ns := range query.Namespaces {
 		promutil.AddToCounter(q.metrics.keysRequested, len(ns.Keys))

service/query/query_service_test.go

@@ -81,6 +81,17 @@ func TestQuery(t *testing.T) {
 		requireResults(t, requiredItems, ret.Namespaces)
 	})
 
+	t.Run("Query GetRows bad namespace ID", func(t *testing.T) {
+		t.Parallel()
+		badQuery, _, _ := makeQuery(requiredItems)
+		badQuery.Namespaces[0].NsId = "$1"
+		client := protoqueryservice.NewQueryServiceClient(env.clientConn)
+		ret, err := client.GetRows(t.Context(), badQuery)
+		require.Error(t, err)
+		require.Nil(t, ret)
+		require.Contains(t, err.Error(), policy.ErrInvalidNamespaceID.Error())
+	})
+
 	t.Run("Query GetRows client with view", func(t *testing.T) {
 		t.Parallel()
 		client := protoqueryservice.NewQueryServiceClient(env.clientConn)